At Sirius Candle, we value your trust as much as a well-crafted scent. This policy explains how we handle your personal data, your rights under the GDPR and the Maltese Data Protection Act, and how we keep your information secure.
1. Who We Are (Data Controller)
Sirius Candle is the Data Controller responsible for your personal data.
Our website and services are intended for adult users (16+). While the legal age of digital consent in Malta is 13, we enforce a strict 16+ policy and do not knowingly collect or process data from anyone under the age of 16.
3. How We Process Your Data
To provide you with the best experience, we process data based on the following framework:
Category
Examples
Purpose
Legal Basis
Retention
Contact & Identity
Name, email, phone, shipping address
Order fulfillment, delivery, & support
Performance of Contract
5 years (Maltese Civil Code limitation period)
Financial Data
Payment info, billing address
Payment processing & fraud prevention
Performance of Contract
10 years (Maltese Companies Act, Cap. 386)
Technical Data
IP address, browser type, device info
Security & site performance
Legitimate Interest
12 months
Marketing Data
Email address, preferences
Newsletters & special offers
Consent
Until you unsubscribe
4. Cookies & Tracking
We use cookies to make our site work and to understand how you use it. You can manage your preferences at any time.
Necessary Cookies: Essential for the site to function (e.g., your shopping cart). These are always active.
Analytics Cookies: Help us see which candles are trending. Active only with your Consent.
Marketing Cookies: Used to show you relevant ads elsewhere. Active only with your Consent.
5. Your Rights & The “Right to Object”
Under the GDPR and local Maltese law, you have significant control over your data:
Access & Rectification: You can request a copy of your data or ask us to fix errors.
Erasure (“Right to be Forgotten”): You can ask us to delete your data (unless legal requirements, like local accounting laws, require us to keep it).
Data Portability: You can request your data in a machine-readable format.
Withdrawal of Consent: You can “Unsubscribe” from marketing at any time.
Important: Right to Object
You have the explicit right to object to any processing based on our Legitimate Interests. If you object, we will stop processing that data unless we can prove compelling grounds that override your privacy rights (e.g., preventing site-wide fraud).
6. Sharing & International Transfers
We only share your data with trusted partners necessary to run our business:
Payments: PayPal, Stripe
Shipping: MaltaPost
Technical: Hosting and security providers.
International Transfers: If we transfer data outside the EU/EEA, we ensure it is protected by Standard Contractual Clauses (SCCs) or equivalent legal safeguards.
7. Complaints
If you feel we aren’t handling your data correctly, please talk to us first! However, you always have the right to lodge a complaint with the Maltese supervisory authority:
Information and Data Protection Commissioner (IDPC)
